Search
Find a vulnerability
Search criteria
4 vulnerabilities by Vembu Technologies
CVE-2025-71452 (GCVE-0-2025-71452)
Vulnerability from nvd – Published: 2026-11-03 19:48 – Updated: 2026-11-03 19:48
VLAI
EPSS
VEX
Title
Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp
Summary
Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://chocapikk.com/posts/2025/bdrsuite/ | technical-descriptionexploit |
| https://support.bdrshield.com/portal/en/kb/articl… | release-notespatch |
| https://www.vulncheck.com/advisories/vembu-bdrsui… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Vembu Technologies | BDRSuite |
Affected:
0 , < 7.6.0
(semver)
|
Date Public
2025-06-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BDRSuite",
"vendor": "Vembu Technologies",
"versions": [
{
"lessThan": "7.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Valentin Lobstein (Chocapikk)"
}
],
"datePublic": "2025-06-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim\u0027s browser session, enabling session hijacking or interface manipulation."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:48:58.651Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Chocapikk Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "https://chocapikk.com/posts/2025/bdrsuite/"
},
{
"name": "Release Notes",
"tags": [
"release-notes",
"patch"
],
"url": "https://support.bdrshield.com/portal/en/kb/articles/release-notes"
},
{
"name": "VulnCheck Advisory: Vembu BDRSuite \u003c 7.6.0 XSS via restoreprogress.sgp",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp"
}
],
"title": "Vembu BDRSuite \u003c 7.6.0 XSS via restoreprogress.sgp",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71452",
"datePublished": "2026-11-03T19:48:58.651Z",
"dateReserved": "2026-11-03T19:31:11.046Z",
"dateUpdated": "2026-11-03T19:48:58.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71451 (GCVE-0-2025-71451)
Vulnerability from nvd – Published: 2026-11-03 19:47 – Updated: 2026-11-07 03:28
VLAI
EPSS
VEX
Title
Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp
Summary
Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:28 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://chocapikk.com/posts/2025/bdrsuite/ | technical-descriptionexploit |
| https://support.bdrshield.com/portal/en/kb/articl… | release-notespatch |
| https://www.vulncheck.com/advisories/vembu-bdrsui… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Vembu Technologies | BDRSuite |
Affected:
0 , < 7.6.0
(semver)
|
Date Public
2025-06-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-71451",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:28:15.713821Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:28:24.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BDRSuite",
"vendor": "Vembu Technologies",
"versions": [
{
"lessThan": "7.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Valentin Lobstein (Chocapikk)"
}
],
"datePublic": "2025-06-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim\u0027s browser session, enabling session hijacking or interface manipulation."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:47:12.578Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Chocapikk Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "https://chocapikk.com/posts/2025/bdrsuite/"
},
{
"name": "Release Notes",
"tags": [
"release-notes",
"patch"
],
"url": "https://support.bdrshield.com/portal/en/kb/articles/release-notes"
},
{
"name": "VulnCheck Advisory: Vembu BDRSuite \u003c 7.6.0 XSS via serverbackupprogress.sgp",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp"
}
],
"title": "Vembu BDRSuite \u003c 7.6.0 XSS via serverbackupprogress.sgp",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71451",
"datePublished": "2026-11-03T19:47:12.578Z",
"dateReserved": "2026-11-03T19:31:11.046Z",
"dateUpdated": "2026-11-07T03:28:24.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71452 (GCVE-0-2025-71452)
Vulnerability from cvelistv5 – Published: 2026-11-03 19:48 – Updated: 2026-11-03 19:48
VLAI
EPSS
VEX
Title
Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp
Summary
Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://chocapikk.com/posts/2025/bdrsuite/ | technical-descriptionexploit |
| https://support.bdrshield.com/portal/en/kb/articl… | release-notespatch |
| https://www.vulncheck.com/advisories/vembu-bdrsui… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Vembu Technologies | BDRSuite |
Affected:
0 , < 7.6.0
(semver)
|
Date Public
2025-06-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BDRSuite",
"vendor": "Vembu Technologies",
"versions": [
{
"lessThan": "7.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Valentin Lobstein (Chocapikk)"
}
],
"datePublic": "2025-06-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim\u0027s browser session, enabling session hijacking or interface manipulation."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:48:58.651Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Chocapikk Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "https://chocapikk.com/posts/2025/bdrsuite/"
},
{
"name": "Release Notes",
"tags": [
"release-notes",
"patch"
],
"url": "https://support.bdrshield.com/portal/en/kb/articles/release-notes"
},
{
"name": "VulnCheck Advisory: Vembu BDRSuite \u003c 7.6.0 XSS via restoreprogress.sgp",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp"
}
],
"title": "Vembu BDRSuite \u003c 7.6.0 XSS via restoreprogress.sgp",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71452",
"datePublished": "2026-11-03T19:48:58.651Z",
"dateReserved": "2026-11-03T19:31:11.046Z",
"dateUpdated": "2026-11-03T19:48:58.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71451 (GCVE-0-2025-71451)
Vulnerability from cvelistv5 – Published: 2026-11-03 19:47 – Updated: 2026-11-07 03:28
VLAI
EPSS
VEX
Title
Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp
Summary
Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:28 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://chocapikk.com/posts/2025/bdrsuite/ | technical-descriptionexploit |
| https://support.bdrshield.com/portal/en/kb/articl… | release-notespatch |
| https://www.vulncheck.com/advisories/vembu-bdrsui… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Vembu Technologies | BDRSuite |
Affected:
0 , < 7.6.0
(semver)
|
Date Public
2025-06-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-71451",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:28:15.713821Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:28:24.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BDRSuite",
"vendor": "Vembu Technologies",
"versions": [
{
"lessThan": "7.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Valentin Lobstein (Chocapikk)"
}
],
"datePublic": "2025-06-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim\u0027s browser session, enabling session hijacking or interface manipulation."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:47:12.578Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Chocapikk Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "https://chocapikk.com/posts/2025/bdrsuite/"
},
{
"name": "Release Notes",
"tags": [
"release-notes",
"patch"
],
"url": "https://support.bdrshield.com/portal/en/kb/articles/release-notes"
},
{
"name": "VulnCheck Advisory: Vembu BDRSuite \u003c 7.6.0 XSS via serverbackupprogress.sgp",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp"
}
],
"title": "Vembu BDRSuite \u003c 7.6.0 XSS via serverbackupprogress.sgp",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71451",
"datePublished": "2026-11-03T19:47:12.578Z",
"dateReserved": "2026-11-03T19:31:11.046Z",
"dateUpdated": "2026-11-07T03:28:24.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}